[zuzuleinen]

"sandboxed-execution: Bazel also runs every action in a "sandbox". You can think of sandbox as being akin to a lightweight container. All the declared-inputs are mapped into the sandbox, and the generated outputs are closely monitored. This is done for each action. If a dependency is missed in the input specification - that's a build failure."

This reminds me of how Nix[1] is doing things under the hood. Recently added Nix to on of our projects[2] which is still a build system using Nix to manage dependencies.

[1]https://nixos.org/

[2]https://bob.build/docs/getting-started/package-management